LLMjacking: stolen AI keys cost one victim nearly $1 million in 8 hours

01What happened

Google Threat Intelligence Group and Mandiant published a report on November 2, 2026 on LLMjacking incidents they responded to across North America, South America and Asia Pacific. Victims include financial services, retail, technology and transportation organizations. In individual incidents, fraudulent inference charges passed $100,000 in a single day.

02How it works

Attackers begin from exposed or stolen cloud identity material: IAM credentials, service account keys, GitHub personal access tokens and session tokens. A stolen key is confirmed with tiny requests, such as a call capped at one output token, which stays below volume alerting in EDR and SIEM tools. GTIG describes a division of labor in which initial access operators hand off to LLM Mixers, routing gateways that pool stolen keys and resell the access to underground subscribers. One actor also kept access by creating and deleting short-lived service accounts, a pattern GTIG calls burn and rotate.

03Who is affected

Organizations using Amazon Bedrock, Azure AI services, the Gemini API and publicly exposed Ollama endpoints are the reported targets. GTIG says that in several incidents the LLM service was not enabled before the compromise, and attackers switched it on with an abused access key.

04What to do

Treat unauthorized enabling of an LLM service as a critical alert, and hunt the per-cloud invocation, reconnaissance and logging-tampering calls GTIG lists. Turn on Google Cloud Data Access logs and Amazon Bedrock model invocation logging, which are both off by default. Scope API keys per model and environment, and set per-model quotas and spending caps.

Questions people ask

Am I exposed to LLMjacking if I never enabled a model API?

LLMjacking victims in the GTIG report often had no LLM service enabled before the intrusion. Attackers used stolen cloud credentials to turn the service on themselves, then ran paid inference against it. Google Threat Intelligence Group advises treating unauthorized enablement of an LLM service as a critical security event, because in several incidents that action was the first sign of compromise.

How do I detect LLMjacking in cloud audit logs?

Detection rests on logs that are off by default. GTIG points to CloudTrail events such as InvokeModel and PutUseCaseForModelAccess on AWS, deployment writes under Microsoft.CognitiveServices on Azure, and EnableService plus GenerateContent on Google Cloud. Inference calls on Google Cloud need Data Access logs enabled, and Amazon Bedrock needs model invocation logging turned on, so neither records attacker activity until an administrator configures it.

Why is stolen model access resold so cheaply?

Resale gateways that GTIG calls LLM Mixers pool stolen API keys and sell shared access to subscribers. Jet Night advertised an unlimited plan at about $60 a month, below the $100 to $250 GTIG estimates for comparable legitimate service. GTIG assesses that the margin depends on stolen keys, because the operator pays nothing for the tokens the victim is billed for.

How does LLMjacking compare with cryptojacking?

Cryptojacking accrues cost slowly while mining runs. LLMjacking concentrates it: GTIG recorded more than $100,000 of charges in a single day at individual victims and nearly $1 million in under 8 hours at one organization. GTIG expects LLMjacking to displace cryptojacking on margin, and predicts more automated hunting for exposed API tokens and more attacks on model routing middleware.

Sources 3 links, all fetched

1. 1cloud.google.comGTIG Report
2. 2docs.aws.amazon.comBedrock Invocation Logs
3. 3docs.cloud.google.comGCP Data Access Logs